GitHub-Mirror/Star64_linux
2
0
Fork 0
mirror of https://github.com/Fishwaldo/Star64_linux.git synced 2025-06-07 07:08:07 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

net: gro: make sure skb->cb[] initial content has not to be zero

Browse source 
Starting from linux-3.13, GRO attempts to build full size skbs.

Problem is the commit assumed one particular field in skb->cb[]
was clean, but it is not the case on some stacked devices.

Timo reported a crash in case traffic is decrypted before
reaching a GRE device.

Fix this by initializing NAPI_GRO_CB(skb)->last at the right place,
this also removes one conditional.

Thanks a lot to Timo for providing full reports and bisecting this.

Fixes: 8a29111c7c ("net: gro: allow to build full sized skb")
Bisected-by: Timo Teras <timo.teras@iki.fi>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Tested-by: Timo Teräs <timo.teras@iki.fi>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Eric Dumazet 2014-05-16 11:34:37 -07:00 • committed by David S. Miller
parent 22fb22eaeb
commit 29e9824278
2 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
net/core/dev.c
View file

@ -3951,6 +3951,7 @@ static enum gro_result dev_gro_receive(struct napi_struct *napi, struct sk_buff
} }
NAPI_GRO_CB(skb)->count = 1; NAPI_GRO_CB(skb)->count = 1;
NAPI_GRO_CB(skb)->age = jiffies; NAPI_GRO_CB(skb)->age = jiffies;
NAPI_GRO_CB(skb)->last = skb;
skb_shinfo(skb)->gso_size = skb_gro_len(skb); skb_shinfo(skb)->gso_size = skb_gro_len(skb);
skb->next = napi->gro_list; skb->next = napi->gro_list;
napi->gro_list = skb; napi->gro_list = skb;

4
net/core/skbuff.c
View file

@ -3076,7 +3076,7 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
if (unlikely(p->len + len >= 65536)) if (unlikely(p->len + len >= 65536))
return -E2BIG; return -E2BIG;
lp = NAPI_GRO_CB(p)->last ?: p; lp = NAPI_GRO_CB(p)->last;
pinfo = skb_shinfo(lp); pinfo = skb_shinfo(lp);
if (headlen <= offset) { if (headlen <= offset) {
@ -3192,7 +3192,7 @@ merge:
__skb_pull(skb, offset); __skb_pull(skb, offset);
if (!NAPI_GRO_CB(p)->last) if (NAPI_GRO_CB(p)->last == p)
skb_shinfo(p)->frag_list = skb; skb_shinfo(p)->frag_list = skb;
else else
NAPI_GRO_CB(p)->last->next = skb; NAPI_GRO_CB(p)->last->next = skb;